Editing GPG Guide

From Bibliotheca Anonoma

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 2: Line 2:


WIP (Ctrl-S's job)
WIP (Ctrl-S's job)


Guide for securely creating a PGP keyset.
Guide for securely creating a PGP keyset.
Line 7: Line 8:
Some smartcards support longer keys.
Some smartcards support longer keys.
This guide will use 2048 bit RSA keys for as much security as is currently practical.
This guide will use 2048 bit RSA keys for as much security as is currently practical.




Line 88: Line 90:
# Let machine boot into persistant liveusb
# Let machine boot into persistant liveusb
# Ubuntu desktop environment should be displayed on your computer.
# Ubuntu desktop environment should be displayed on your computer.


=== Update liveUSB software ===
=== Update liveUSB software ===
Line 145: Line 148:
gpg/card>
gpg/card>
</syntaxhighlight>
</syntaxhighlight>


== Remove machine from network ==
== Remove machine from network ==
Line 154: Line 158:
</syntaxhighlight>
</syntaxhighlight>
* You should fail to connect.
* You should fail to connect.


== Generate keys ==
== Generate keys ==
* !!! BE OFFLINE !!!
* !!! BE OFFLINE !!!
=== GPG Secret keys ===
=== GPG Secret keys ===
* Create master as demonstrated in the following example:
* Create master as demonstrated in the following example:
Line 474: Line 483:
$ ## Finished creating the subkeys.
$ ## Finished creating the subkeys.
</syntaxhighlight>
</syntaxhighlight>


=== Store keys to backup drives ===
=== Store keys to backup drives ===
Line 486: Line 497:
$ cd '/medua/ubuntu/keystore01/gpg.ctrl-s.2020-02-01'
$ cd '/medua/ubuntu/keystore01/gpg.ctrl-s.2020-02-01'
</syntaxhighlight>
</syntaxhighlight>


* Secret keys:
* Secret keys:
Line 626: Line 638:
gpg/card> quit ## Exit GPG.
gpg/card> quit ## Exit GPG.
</syntaxhighlight>
</syntaxhighlight>


=== Reload the secret key and subkeys from the backup file ===
=== Reload the secret key and subkeys from the backup file ===
This is required if you want to prepare more than one smartcard.
This is required if you want to prepare more than one smartcard.


==== Delete GPG keystore ====
==== Delete GPG keystore ====
Line 639: Line 653:
$ date; rm -rf ~/.gnupg/ # Erase GPG keystore alltogether.
$ date; rm -rf ~/.gnupg/ # Erase GPG keystore alltogether.
</syntaxhighlight>
</syntaxhighlight>


==== Import secret key from file ====
==== Import secret key from file ====
Line 647: Line 662:
$ date; gpg --allow-secret-key-import --import FEEDB00BCODEBEEF-20200530.subkeys.txt
$ date; gpg --allow-secret-key-import --import FEEDB00BCODEBEEF-20200530.subkeys.txt
</syntaxhighlight>
</syntaxhighlight>


==== Set imported secretkey to maximum trust level ====
==== Set imported secretkey to maximum trust level ====
Line 657: Line 673:
gpg>save # Save changes and exit GPG.
gpg>save # Save changes and exit GPG.
</syntaxhighlight>
</syntaxhighlight>


=== Move the key to smartcard ===
=== Move the key to smartcard ===
Line 692: Line 711:
gpg> y ## Confirm the trust setting.
gpg> y ## Confirm the trust setting.
</syntaxhighlight>
</syntaxhighlight>


== Erase keys from liveusb ==
== Erase keys from liveusb ==
Line 699: Line 721:
$ rm -rf ~/.gnupg*
$ rm -rf ~/.gnupg*
</syntaxhighlight>
</syntaxhighlight>


=== Setup public key side ===
=== Setup public key side ===
Line 705: Line 729:


=== Set up key on machine we want to SSH to ===
=== Set up key on machine we want to SSH to ===
Open the authorized_keys for your user account and paste in the SSH key
(Created earlier in this guide as "FEEDB00BCODEBEEF-1970JAN01.ssh-remote.key")
<syntaxhighlight lang="bash">
<syntaxhighlight lang="bash">
$ mkdir -vp ~/.ssh/ ; touch ~/.ssh/authorized_keys; # Create authorized_keys if it does not exist.
## TODO
$ nano ~/.ssh/authorized_keys # Edit authorized_keys file
</syntaxhighlight>
</syntaxhighlight>


Line 722: Line 743:
</syntaxhighlight>
</syntaxhighlight>
https://github.com/drduh/YubiKey-Guide#using-multiple-keys
https://github.com/drduh/YubiKey-Guide#using-multiple-keys
== WSL  (Windows Subsystem for Linux) ==
* ! WIP !
Getting SSH to work in WSL.
https://github.com/drduh/YubiKey-Guide#using-multiple-keys
https://github.com/vuori/weasel-pageant
* Download and extract weasel-pagent to somewhere convenient on the windows side.
https://github.com/vuori/weasel-pageant/releases
Place this line in your .bashrc file
<syntaxhighlight lang="bash">$ nano ~./bashrc</syntaxhighlight>
<syntaxhighlight lang="bash">
# Make GNUPG / GPG work with windows smartcards weasel-pageant
eval $(<location where you unpacked the zip>/weasel-pageant -rb -a $HOME/.weasel-pageant.sock)
</syntaxhighlight>
Reload the config from the updated file:
<syntaxhighlight lang="bash">$ source ~/.bashrc</syntaxhighlight>
Add entry to the ~/.ssh/config file:
<syntaxhighlight lang="bash">nano ~/.ssh/config</syntaxhighlight>
<syntaxhighlight lang="bash">
ForwardAgent yes
RemoteForward /root/.gnupg/S.gpg-agent.ssh $HOME/.weasel-pageant.sock
</syntaxhighlight>
<syntaxhighlight lang="bash">$ chmod 600 ~/.ssh/config ; chown $USER ~/.ssh/config # Ensure you have the correct owner and permissions for the config file.</syntaxhighlight>
Test if it works:
<syntaxhighlight lang="bash">$ ssh-add -l</syntaxhighlight>
If it is working it will show your key in the list it gives.
if you get the erro :
chmod 600 ~/.ssh/config
=== Automating on Windows ===
Save the following script to a .bat file. (e.g.  `C:\scripts\gpg_refresh.bat`)
<syntaxhighlight lang="cmd">
@echo off
rem gpg_refresh.bat
rem Check if our key is on an attached smartcard and associate it if so.
gpg-connect-agent "scd serialno" "learn --force" /bye
</syntaxhighlight>
* Press the start button on your keyboard to open the start menu.
* Type "schedule", "Task Scheduler" should appear as a search result in the start menu.
* Open Task Scheduler.
* In the section on the right of the window (Under the heading "Actions") select "Create Task".
* Set the Name to `Check and Update GPG smartcards`
* Set the description to `Tell GPG to compare its keys against smartcards, and link any that match.`
** "Name" : "1 hour"
** "Description" : "1 hour"
** "Security options" -> "Run whether user is logged on or not" : Selected. (Hides command window when task runs)
** "Security options" -> "Do not store password. The task will only have access to local computer resources." : Selected. (Prevents requiring user's password to be entered to set up task.)
* This task must be running using your user account, so that the instance of GPG associated with your account is acted on.
** "Configure for:": "Windows 10"
* Click on the "Triggers" tab at the top of the window then click the "New" button
* In the "New Trigger" window that opens:
** "Begin the task": `On a schedule`
** Settings -> "Daily" selected.
** Settings -> "Start": Set a value in the next hour or so.
** Settings -> "Recur every" [ ] days: "1"
** "Advanced setings" -> "Repeat task every": Box checked.
** "Advanced setings" -> "Repeat task every" : "1 hour"
** "Advanced setings" -> "for a duration of" : "1 day"
** "Advanced setings" -> "Expire": Box unchecked. (Never expire)
** "Advanced setings" -> "Enabled": Box checked.
* Click "OK" once these settings are set.
* Click on the "Actions" tab at the top of the window then click the "New" button
* In the "New Action" window that opens:
** "Settings` -> "Action": "Start a program"
** "Settings" -> "Program/script" : The path to the .bat file.
* Click "OK" once these settings are set.
* Click "OK" in the "Create Task" window.
https://stackoverflow.com/questions/4249542/run-a-task-every-x-minutes-with-windows-task-scheduler
https://www.howtogeek.com/tips/how-to-run-a-scheduled-task-without-a-command-window-appearing/
== Troubleshooting ==
To kill running background  GPG:
<syntaxhighlight lang="cmd">
gpg-connect-agent killagent /bye # Kill GPG.
</syntaxhighlight>
To start background GPG:
<syntaxhighlight lang="cmd">
gpg-connect-agent /bye # Start GPG.
</syntaxhighlight>
To inspect connected card(s?):
<syntaxhighlight lang="cmd">
gpg --card-status # Inspect smartcard.
</syntaxhighlight>


== Sources ==
== Sources ==
Please note that all contributions to Bibliotheca Anonoma are considered to be released under the Creative Commons Attribution-ShareAlike (see Bibliotheca Anonoma:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!
Cancel Editing help (opens in new window)
Retrieved from "https://wiki.bibanon.org/GPG_Guide"